On Tue, 28 Feb 2017, Peter Chen wrote:
> When the user does device unbind and rebind test, the kernel will
> show below dump due to usb_gadget memory region is dirty after unbind.
> Clear usb_gadget region for every new probe.
>
> root@imx6qdlsolo:/sys/bus/platform/drivers/dummy_udc# echo dummy_udc.0 > bind
> [ 102.523312] kobject (eddd78b0): tried to init an initialized object, something is seriously wrong.
> [ 102.532447] CPU: 0 PID: 734 Comm: sh Not tainted 4.10.0-rc7-00872-g1b2b8e9 #1298
> [ 102.539866] Hardware name: Freescale i.MX6 SoloX (Device Tree)
> [ 102.545717] Backtrace:
> [ 102.548225] [<c010d090>] (dump_backtrace) from [<c010d338>] (show_stack+0x18/0x1c)
> [ 102.555822] r7:ede34000 r6:60010013 r5:00000000 r4:c0f29418
> [ 102.561512] [<c010d320>] (show_stack) from [<c040c2a4>] (dump_stack+0xb4/0xe8)
> [ 102.568764] [<c040c1f0>] (dump_stack) from [<c040e6d4>] (kobject_init+0x80/0x9c)
> [ 102.576187] r10:0000001f r9:eddd7000 r8:eeaf8c10 r7:eddd78a8 r6:c177891c r5:c0f3b060
> [ 102.584036] r4:eddd78b0 r3:00000000
> [ 102.587641] [<c040e654>] (kobject_init) from [<c05359a4>] (device_initialize+0x28/0xf8)
> [ 102.595665] r5:eebc4800 r4:eddd78a8
> [ 102.599268] [<c053597c>] (device_initialize) from [<c05382ac>] (device_register+0x14/0x20)
> [ 102.607556] r7:eddd78a8 r6:00000000 r5:eebc4800 r4:eddd78a8
> [ 102.613256] [<c0538298>] (device_register) from [<c0668ef4>] (usb_add_gadget_udc_release+0x8c/0x1ec)
> [ 102.622410] r5:eebc4800 r4:eddd7860
> [ 102.626015] [<c0668e68>] (usb_add_gadget_udc_release) from [<c0669068>] (usb_add_gadget_udc+0x14/0x18)
> [ 102.635351] r10:0000001f r9:eddd7000 r8:eddd788c r7:bf003770 r6:eddd77f8 r5:eddd7818
> [ 102.643198] r4:eddd785c r3:eddd7b24
> [ 102.646834] [<c0669054>] (usb_add_gadget_udc) from [<bf003428>] (dummy_udc_probe+0x170/0x1c4 [dummy_hcd])
> [ 102.656458] [<bf0032b8>] (dummy_udc_probe [dummy_hcd]) from [<c053d114>] (platform_drv_probe+0x54/0xb8)
> [ 102.665881] r10:00000008 r9:c1778960 r8:bf004128 r7:fffffdfb r6:bf004128 r5:eeaf8c10
> [ 102.673727] r4:eeaf8c10
> [ 102.676293] [<c053d0c0>] (platform_drv_probe) from [<c053b160>] (driver_probe_device+0x264/0x474)
> [ 102.685186] r7:00000000 r6:00000000 r5:c1778960 r4:eeaf8c10
> [ 102.690876] [<c053aefc>] (driver_probe_device) from [<c05397c4>] (bind_store+0xb8/0x14c)
> [ 102.698994] r10:eeb3bb4c r9:ede34000 r8:0000000c r7:eeaf8c44 r6:bf004128 r5:c0f3b668
> [ 102.706840] r4:eeaf8c10
> [ 102.709402] [<c053970c>] (bind_store) from [<c0538ca8>] (drv_attr_store+0x28/0x34)
> [ 102.716998] r9:ede34000 r8:00000000 r7:ee3863c0 r6:ee3863c0 r5:c0538c80 r4:c053970c
> [ 102.724776] [<c0538c80>] (drv_attr_store) from [<c029c930>] (sysfs_kf_write+0x50/0x54)
> [ 102.732711] r5:c0538c80 r4:0000000c
> [ 102.736313] [<c029c8e0>] (sysfs_kf_write) from [<c029be84>] (kernfs_fop_write+0x100/0x214)
> [ 102.744599] r7:ee3863c0 r6:eeb3bb40 r5:00000000 r4:00000000
> [ 102.750287] [<c029bd84>] (kernfs_fop_write) from [<c0222dd8>] (__vfs_write+0x34/0x120)
> [ 102.758231] r10:00000000 r9:ede34000 r8:c0108bc4 r7:0000000c r6:ede35f80 r5:c029bd84
> [ 102.766077] r4:ee223780
> [ 102.768638] [<c0222da4>] (__vfs_write) from [<c0224678>] (vfs_write+0xa8/0x170)
> [ 102.775974] r9:ede34000 r8:c0108bc4 r7:ede35f80 r6:01861cb0 r5:ee223780 r4:0000000c
> [ 102.783743] [<c02245d0>] (vfs_write) from [<c0225498>] (SyS_write+0x4c/0xa8)
> [ 102.790818] r9:ede34000 r8:c0108bc4 r7:0000000c r6:01861cb0 r5:ee223780 r4:ee223780
> [ 102.798595] [<c022544c>] (SyS_write) from [<c0108a20>] (ret_fast_syscall+0x0/0x1c)
> [ 102.806188] r7:00000004 r6:b6e83d58 r5:01861cb0 r4:0000000c
>
> Cc: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxxxxxxx>
> Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
> Signed-off-by: Peter Chen <peter.chen@xxxxxxx>
> Tested-by: Xiaolong Ye <xiaolong.ye@xxxxxxxxx>
> Reported-by: Fengguang Wu <fengguang.wu@xxxxxxxxx>
> ---
> drivers/usb/gadget/udc/dummy_hcd.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
> index c60abe3..8cabc59 100644
> --- a/drivers/usb/gadget/udc/dummy_hcd.c
> +++ b/drivers/usb/gadget/udc/dummy_hcd.c
> @@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
> int rc;
>
> dum = *((void **)dev_get_platdata(&pdev->dev));
> + /* Clear usb_gadget region for new registration to udc-core */
> + memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
> dum->gadget.name = gadget_name;
> dum->gadget.ops = &dummy_ops;
> dum->gadget.max_speed = USB_SPEED_SUPER;
Wouldn't it be better to clear the entire structure, not just
dum->gadget? Then you could also change
dum[i] = kzalloc(sizeof(struct dummy), GFP_KERNEL);
to use kmalloc, since the structure will be initialized by the probe
routine.
Alan Stern